ASEC describes weekly changes in CHM malware impersonating Korean financial and insurance institutions, where execution begins through hh.exe, decompiled internal HTML, and a generated JSE script launched by wscript. One variant preserved registry-based persistence but changed download and execution behavior depending on whether AhnLab products were installed, while another directly dropped and executed a .NET payload. The newer payload structure resembled earlier samples but shifted from information theft toward reverse-connection backdoor behavior. The report links the activity to hashes, detection names, and infrastructure such as atusay.lat/kxydo and zienk.sbs/kjntf.